cscli scenarios install crowdsecurity/http-probingTake remediation against a single IP that requires multiple different (http path) pages that end up in 404/403/400.
Leakspeed of 10s, capacity of 10.
1# 404 scan2type: leaky3#debug: true4name: crowdsecurity/http-probing5description: "Detect site scanning/probing from a single ip"6filter: "evt.Meta.service == 'http' && evt.Meta.http_status in ['404', '403', '400'] && evt.Parsed.static_ressource == 'false'"7groupby: "evt.Meta.source_ip + '/' + evt.Parsed.target_fqdn"8distinct: "evt.Meta.http_path"9capacity: 1010reprocess: true11leakspeed: "10s"12blackhole: 5m13labels:14 remediation: true15 classification:16 - attack.T159517 behavior: "http:scan"18 label: "HTTP Probing"19 spoofable: 020 service: http21 confidence: 122